Zero-Day Exploit in Ivanti VPN Allows Hackers Network Access

A critical zero-day vulnerability (CVE-2025-0282) in Ivanti's widely used enterprise VPN appliance has been exploited by hackers to compromise corporate networks. The vulnerability affects Connect Secure, Policy Secure, and ZTA Gateways products, with Connect Secure being the most widely adopted SSL VPN. Mandiant and Microsoft researchers observed exploitation as early as mid-December 2024. The attack shows hallmarks of an advanced persistent threat (APT), and suspicions point towards a China-linked cyberespionage group. Ivanti has released a patch for Connect Secure, with patches for others coming January 21st.